1 .TH IPSEC_SPIGRP 8 "21 Jun 2000"
3 .\" RCSID $Id: spigrp.8,v 1.19 2000/09/17 18:56:48 rgb Exp $
6 ipsec spigrp \- group/ungroup IPSEC Security Associations
16 af1 dst1 spi1 proto1 [ af2 dst2 spi2 proto2 [ af3 dst3 spi3 proto3 [ af4 dst4 spi4 proto4 ] ] ]
24 SA1 [ SA2 [ SA3 [ SA4 ] ] ]
36 groups IPSEC Security Associations (SAs) together or ungroups
37 previously grouped SAs.
38 An entry in the IPSEC extended
39 routing table can only point
40 (via a destination address, a Security Parameters Index (SPI) and
41 a protocol identifier) to one SA.
42 If more than one transform must be applied to a given type of packet,
43 this can be accomplished by setting up several SAs
44 with the same destination address but potentially different SPIs and protocols,
45 and grouping them with
48 The SAs to be grouped,
49 specified by destination address (DNS name lookup, IPv4 dotted quad or IPv6 coloned hex), SPI
50 ('0x'-prefixed hexadecimal number) and protocol ("ah", "esp", "comp" or "tun"),
51 are listed from the inside transform to the
53 in other words, the transforms are applied in
54 the order of the command line and removed in the reverse
56 The resulting SA group is referred to by its first SA (by
63 The \-\-said option indicates that the SA IDs are to be specified as
64 one argument each, in the format <proto><af><spi>@<dest>. The SA IDs must
65 all be specified as separate parameters without the \-\-said option or
66 all as monolithic parameters after the \-\-said option.
68 The SAs must already exist and must not already
73 is invoked with only one SA specification,
74 it ungroups the previously-grouped set of SAs containing
77 The \-\-label option identifies all responses from that command
78 invocation with a user-supplied label, provided as an argument to the
79 label option. This can be helpful for debugging one invocation of the
80 command out of a large number.
82 The command form with no additional arguments lists the contents of
83 /proc/net/ipsec_spigrp. The format of /proc/net/ipsec_spigrp is
84 discussed in ipsec_spigrp(5).
87 .B ipsec spigrp inet gw2 0x113 tun inet gw2 0x115 esp inet gw2 0x116 ah
88 groups 3 SAs together, all destined for
90 but with an IPv4-in-IPv4 tunnel SA applied first with SPI
92 then an ESP header to encrypt the packet with SPI
94 and finally an AH header to authenticate the packet with SPI
98 .B ipsec spigrp --said tun.113@gw2 esp.115@gw2 ah.116@gw2
99 groups 3 SAs together, all destined for
101 but with an IPv4-in-IPv4 tunnel SA applied first with SPI
103 then an ESP header to encrypt the packet with SPI
105 and finally an AH header to authenticate the packet with SPI
109 .B ipsec spigrp --said tun:233@3049:1::1 esp:235@3049:1::1 ah:236@3049:1::1
110 groups 3 SAs together, all destined for
112 but with an IPv6-in-IPv6 tunnel SA applied first with SPI
114 then an ESP header to encrypt the packet with SPI
116 and finally an AH header to authenticate the packet with SPI
120 .B ipsec spigrp inet6 3049:1::1 0x233 tun inet6 3049:1::1 0x235 esp inet6 3049:1::1 0x236 ah
121 groups 3 SAs together, all destined for
123 but with an IPv6-in-IPv6 tunnel SA applied first with SPI
125 then an ESP header to encrypt the packet with SPI
127 and finally an AH header to authenticate the packet with SPI
131 /proc/net/ipsec_spigrp, /usr/local/bin/ipsec
133 ipsec(8), ipsec_manual(8), ipsec_tncfg(8), ipsec_eroute(8),
134 ipsec_spi(8), ipsec_klipsdebug(8), ipsec_spigrp(5)
136 Written for the Linux FreeS/WAN project
137 <http://www.freeswan.org/>
138 by Richard Guy Briggs.
140 Yes, it really is limited to a maximum of four SAs,
141 although admittedly it's hard to see why you would need more.
143 .\" $Log: spigrp.8,v $
144 .\" Revision 1.19 2000/09/17 18:56:48 rgb
145 .\" Added IPCOMP support.
147 .\" Revision 1.18 2000/09/13 15:54:32 rgb
148 .\" Added Gerhard's ipv6 updates.
150 .\" Revision 1.17 2000/06/30 18:21:55 rgb
151 .\" Update SEE ALSO sections to include ipsec_version(5) and ipsec_pf_key(5)
152 .\" and correct FILES sections to no longer refer to /dev/ipsec which has
153 .\" been removed since PF_KEY does not use it.
155 .\" Revision 1.16 2000/06/21 16:54:57 rgb
156 .\" Added 'no additional args' text for listing contents of
157 .\" /proc/net/ipsec_* files.
159 .\" Revision 1.15 2000/02/14 21:08:30 rgb
160 .\" Added description of --said option.
162 .\" Revision 1.14 1999/07/19 18:47:25 henry
163 .\" fix slightly-misformed comments
165 .\" Revision 1.13 1999/04/06 04:54:39 rgb
166 .\" Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
167 .\" patch shell fixes.